# org.apache.james:james-server (Maven) vulnerabilities 12 known vulnerabilities (1 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.9.1 (Sep 25, 2026): no advisory affects it - Newest unaffected release: 3.9.1 (Sep 25, 2026), the latest release - Dependents: 1 - Releases: 28 since 3.0.0 (Jul 18, 2017) - Registry: https://central.sonatype.com/artifact/org.apache.james/james-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-85111: 3.0-beta2 to 3.9.0 (3.9.1 is outside it) - CVE-2023-51747: 3.0-beta2 to 3.7.4 (3.7.5 is outside it); 3.8.0 (3.8.1 is outside it) - CVE-2023-51518: 3.0-beta2 to 3.7.4 (3.7.5 is outside it); 3.8.0 (3.8.1 is outside it) - CVE-2022-45935: 3.0-beta2 to 3.7.2 (3.7.3 is outside it) - CVE-2022-28220: 3.0-beta2 to 3.7.0 (3.7.1 is outside it) - CVE-2022-22931: 3.0-beta2 to 3.6.0 (3.6.2 is outside it) - CVE-2021-40525: 3.0-beta2 to 3.6.0 (3.6.2 is outside it) - CVE-2021-40111: 3.0-beta2 to 3.6.0 (3.6.2 is outside it) - CVE-2021-40110: 3.1.0 to 3.6.0 (3.6.2 is outside it) - CVE-2021-38542: 3.0-beta2 to 3.6.0 (3.6.2 is outside it) - CVE-2015-7611: no published release is affected - CVE-2004-2650: no published release is affected ## Advisories (12) ### [CVE-2026-85111](https://cve.now/CVE-2026-85111): Apache James: Denial of service upon MIME parsing - Severity: High 8.7 - Published: Nov 6, 2026 - Affected: fixed in 3.9.1. - Fixed in 3.9.1 (released Sep 25, 2026, 42 days before disclosure). - The latest release, 3.9.1, is not affected. ### [CVE-2023-51747](https://cve.now/CVE-2023-51747): SMTP smuggling in Apache James - Severity: High 7.1 - Published: Feb 27, 2024 - Affected: fixed in 3.7.5; from 3.8.0, fixed in 3.8.1. - Fixed in 3.7.5 (released Feb 12, 2024, 15 days before disclosure) and 3.8.1 (released Feb 11, 2024, 16 days before disclosure). - The latest release, 3.9.1, is not affected. ### [CVE-2023-51518](https://cve.now/CVE-2023-51518): Apache James server: Privilege escalation via JMX pre-authentication deserialisation - Severity: Critical 9.8 - Published: Feb 27, 2024 - Affected: fixed in 3.7.5; from 3.8.0, fixed in 3.8.1. - Fixed in 3.7.5 (released Feb 12, 2024, 15 days before disclosure) and 3.8.1 (released Feb 11, 2024, 16 days before disclosure). - The latest release, 3.9.1, is not affected. ### [CVE-2022-45935](https://cve.now/CVE-2022-45935): Apache James server: Temporary File Information Disclosure - Severity: Medium 5.5 - Published: Jan 6, 2023 - Affected: through 3.7.2. - Fixed in 3.7.3 (released Dec 30, 2022, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.1, is not affected. ### [CVE-2022-28220](https://cve.now/CVE-2022-28220): STARTTLS command injection in Apache JAMES - Severity: Unrated - Published: Sep 8, 2022 - Affected: fixed in 3.6.3; from 3.7.0, fixed in 3.7.1. - Fixed in 3.7.1 (released Aug 26, 2022, 13 days before disclosure, the advisory names 3.6.3, which was never published). - The latest release, 3.9.1, is not affected. ### [CVE-2022-22931](https://cve.now/CVE-2022-22931): Path traversal in Apache James 3.6.1 - Severity: Unrated - Published: Feb 7, 2022 - Affected: fixed in 3.6.2. - Fixed in 3.6.2 (released Jan 26, 2022, 12 days before disclosure). - The latest release, 3.9.1, is not affected. ### [CVE-2021-40525](https://cve.now/CVE-2021-40525): Sieve file storage vulnerable to path traversal attacks - Severity: Unrated - Published: Jan 4, 2022 - Affected: fixed in 3.6.1. - Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published). - The latest release, 3.9.1, is not affected. ### [CVE-2021-40111](https://cve.now/CVE-2021-40111): Apache James IMAP parsing Denial Of Service - Severity: Unrated - Published: Jan 4, 2022 - Affected: fixed in 3.6.1. - Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published). - The latest release, 3.9.1, is not affected. ### [CVE-2021-40110](https://cve.now/CVE-2021-40110): Apache James IMAP vulnerable to a ReDoS - Severity: Unrated - Published: Jan 4, 2022 - Affected: from 3.1.0, fixed in 3.6.1. - Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published). - The latest release, 3.9.1, is not affected. ### [CVE-2021-38542](https://cve.now/CVE-2021-38542): Apache James vulnerable to STARTTLS command injection (IMAP and POP3) - Severity: Unrated - Published: Jan 4, 2022 - Affected: fixed in 3.6.1. - Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published). - The latest release, 3.9.1, is not affected. ### [CVE-2015-7611](https://cve.now/CVE-2015-7611): Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via… - Severity: Unrated - Published: Jun 7, 2016 - Affected: fixed in 2.3.2.1. - Fixed in 3.0.0 (released Jul 18, 2017, 406 days after disclosure, the advisory names 2.3.2.1, which was never published). - The latest release, 3.9.1, is not affected. ### [CVE-2004-2650](https://cve.now/CVE-2004-2650): Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error… - Severity: Unrated - Published: Dec 9, 2005 - Affected: fixed in 2.2.0. - Fixed in 3.0.0 (released Jul 18, 2017, 4239 days after disclosure, the advisory names 2.2.0, which was never published). - The latest release, 3.9.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.james:james-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.